0N/A

0N/A

0N/Aimport java.io.*;

0N/Aimport java.util.*;

0N/Aimport java.net.*;

0N/Aimport java.security.*;

0N/Aimport sun.net.www.*;

0N/A

0N/A

0N/Aclass DigestServer extends Thread {

0N/A

0N/A ServerSocket s;

0N/A Socket s1;

0N/A InputStream is;

0N/A OutputStream os;

0N/A int port;

0N/A

0N/A String reply1 = "HTTP/1.1 401 Unauthorized\r\n"+

0N/A "WWW-Authenticate: Digest realm=\""+realm+"\" domain=/ "+

0N/A "nonce=\""+nonce+"\" qop=\"auth\"\r\n\r\n";

0N/A

0N/A String reply2 = "HTTP/1.1 200 OK\r\n" +

0N/A "Date: Mon, 15 Jan 2001 12:18:21 GMT\r\n" +

0N/A "Server: Apache/1.3.14 (Unix)\r\n" +

0N/A "Content-Type: text/html; charset=iso-8859-1\r\n" +

0N/A "Transfer-encoding: chunked\r\n\r\n"+

0N/A "B\r\nHelloWorld1\r\n"+

0N/A "B\r\nHelloWorld2\r\n"+

0N/A "B\r\nHelloWorld3\r\n"+

0N/A "B\r\nHelloWorld4\r\n"+

0N/A "B\r\nHelloWorld5\r\n"+

0N/A "0\r\n"+

0N/A "Authentication-Info: ";

0N/A

0N/A DigestServer (ServerSocket y) {

0N/A s = y;

0N/A port = s.getLocalPort();

0N/A }

0N/A

0N/A public void run () {

0N/A try {

0N/A s1 = s.accept ();

0N/A is = s1.getInputStream ();

0N/A os = s1.getOutputStream ();

0N/A is.read ();

0N/A os.write (reply1.getBytes());

0N/A Thread.sleep (2000);

0N/A s1.close ();

0N/A

0N/A s1 = s.accept ();

0N/A is = s1.getInputStream ();

0N/A os = s1.getOutputStream ();

0N/A is.read ();

0N/A // need to get the cnonce out of the response

0N/A MessageHeader header = new MessageHeader (is);

0N/A String raw = header.findValue ("Authorization");

0N/A HeaderParser parser = new HeaderParser (raw);

0N/A String cnonce = parser.findValue ("cnonce");

0N/A String cnstring = parser.findValue ("nc");

0N/A

0N/A String reply = reply2 + getAuthorization (uri, "GET", cnonce, cnstring) +"\r\n";

0N/A os.write (reply.getBytes());

0N/A Thread.sleep (2000);

0N/A s1.close ();

2612N/A } catch (Exception e) {

0N/A System.out.println (e);

0N/A e.printStackTrace();

2612N/A } finally {

2612N/A try { s.close(); } catch (IOException unused) {}

0N/A }

0N/A }

0N/A

0N/A static char[] passwd = "password".toCharArray();

0N/A static String username = "user";

0N/A static String nonce = "abcdefghijklmnopqrstuvwxyz";

0N/A static String realm = "wallyworld";

0N/A static String uri = "/foo.html";

0N/A

0N/A private String getAuthorization (String uri, String method, String cnonce, String cnstring) {

0N/A String response;

0N/A

0N/A try {

0N/A response = computeDigest(false, username,passwd,realm,

0N/A method, uri, nonce, cnonce, cnstring);

0N/A } catch (NoSuchAlgorithmException ex) {

0N/A return null;

0N/A }

0N/A

0N/A String value = "Digest"

0N/A + " qop=auth\""

0N/A + "\", cnonce=\"" + cnonce

0N/A + "\", rspauth=\"" + response

0N/A + "\", nc=\"" + cnstring + "\"";

0N/A return (value+ "\r\n");

0N/A }

0N/A

0N/A private String computeDigest(

0N/A boolean isRequest, String userName, char[] password,

0N/A String realm, String connMethod,

0N/A String requestURI, String nonceString,

0N/A String cnonce, String ncValue

0N/A ) throws NoSuchAlgorithmException

0N/A {

0N/A

0N/A String A1, HashA1;

0N/A

0N/A MessageDigest md = MessageDigest.getInstance("MD5");

0N/A

0N/A {

0N/A A1 = userName + ":" + realm + ":";

0N/A HashA1 = encode(A1, password, md);

0N/A }

0N/A

0N/A String A2;

0N/A if (isRequest) {

0N/A A2 = connMethod + ":" + requestURI;

0N/A } else {

0N/A A2 = ":" + requestURI;

0N/A }

0N/A String HashA2 = encode(A2, null, md);

0N/A String combo, finalHash;

0N/A

0N/A { /* RRC2617 when qop=auth */

0N/A combo = HashA1+ ":" + nonceString + ":" + ncValue + ":" +

0N/A cnonce + ":auth:" +HashA2;

0N/A

0N/A }

0N/A finalHash = encode(combo, null, md);

0N/A return finalHash;

0N/A }

0N/A

0N/A private final static char charArray[] = {

0N/A '0', '1', '2', '3', '4', '5', '6', '7',

0N/A '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'

0N/A };

0N/A

0N/A private String encode(String src, char[] passwd, MessageDigest md) {

0N/A md.update(src.getBytes());

0N/A if (passwd != null) {

0N/A byte[] passwdBytes = new byte[passwd.length];

0N/A for (int i=0; i<passwd.length; i++)

0N/A passwdBytes[i] = (byte)passwd[i];

0N/A md.update(passwdBytes);

0N/A Arrays.fill(passwdBytes, (byte)0x00);

0N/A }

0N/A byte[] digest = md.digest();

0N/A

0N/A StringBuffer res = new StringBuffer(digest.length * 2);

0N/A for (int i = 0; i < digest.length; i++) {

0N/A int hashchar = ((digest[i] >>> 4) & 0xf);

0N/A res.append(charArray[hashchar]);

0N/A hashchar = (digest[i] & 0xf);

0N/A res.append(charArray[hashchar]);

0N/A }

0N/A return res.toString();

0N/A }

0N/A

0N/A}

0N/A

0N/Apublic class DigestTest {

0N/A

0N/A static class MyAuthenticator extends Authenticator {

0N/A public MyAuthenticator () {

0N/A super ();

0N/A }

0N/A

0N/A public PasswordAuthentication getPasswordAuthentication ()

0N/A {

0N/A return (new PasswordAuthentication ("user", "Wrongpassword".toCharArray()));

0N/A }

0N/A }

0N/A

0N/A

0N/A public static void main(String[] args) throws Exception {

2612N/A int port;

0N/A DigestServer server;

0N/A ServerSocket sock;

0N/A

0N/A try {

2612N/A sock = new ServerSocket (0);

0N/A port = sock.getLocalPort ();

0N/A }

0N/A catch (Exception e) {

0N/A System.out.println ("Exception: " + e);

0N/A return;

0N/A }

0N/A

0N/A server = new DigestServer(sock);

0N/A server.start ();

0N/A boolean passed = false;

0N/A

0N/A try {

0N/A Authenticator.setDefault (new MyAuthenticator ());

0N/A String s = "http://localhost:" + port + DigestServer.uri;

0N/A URL url = new URL(s);

0N/A java.net.URLConnection conURL = url.openConnection();

0N/A

0N/A InputStream in = conURL.getInputStream();

2612N/A while (in.read () != -1) {}

0N/A in.close ();

2612N/A } catch(ProtocolException e) {

0N/A passed = true;

0N/A }

2612N/A

0N/A if (!passed) {

0N/A throw new RuntimeException ("Expected a ProtocolException from wrong password");

0N/A }

0N/A }

0N/A}